CEL_MODULE_FREE (Compact 2013)
3/28/2014
This structure identifies a module that was loaded.
Syntax
typedef __CEL_MODULE_FREE {
HANDLE hProcess;
HANDLE hModule;
} CEL_MODULE_FREE, *PCEL_MODULE_FREE;
Members
hProcess
Handle of the process that freed the module.In Windows CE 5.0, if this field is INVALID_HANDLE_VALUE (0xFFFFFFFF), the event indicates that the module was unloaded for the last time. After this event, no instances of the module are loaded by any process.
- hModule
Handle of the freed module.
Remarks
In Windows CE 5.0, CEL_MODULE_FREE is logged each time a process unloads the module for the last time.
If several processes load and then unload the module, one CEL_MODULE_FREE event is logged for each process.
When a process is the last process to unload a module, the kernel logs two CEL_MODULE_FREE structures:
- A CEL_MODULE_FREE structure is logged with an hProcess value set to the handle of the last process to unload the module.
- Another CEL_MODULE_FREE structure is logged with an hProcess value set to INVALID_HANDLE_VALUE to indicate that the module is being unloaded for the last time by any process.
If any process unloads the module more than once, only one CEL_MODULE_FREE event is logged for that process.
Requirements
Header |
celog.h |